Security and Deployment Diagrams Quiz

Certified Cybersecurity Technician (CCT)

• CCT is a certification offered by EC-Council
• It focuses on cybersecurity skills, labs, and exams
• The course is delivered by Emmanuel Ayam
• Includes various social media links for the instructor

Module 9: Application Security

• Application security involves managing and administering application security on networks and computers

• 9.1 What is a Secure Application

  • A secure application ensures confidentiality, integrity, and availability
  • A restricted resource is any object, data, feature or function designed to be accessed by authorized users
  • Authentication is the checking of the veracity of a secret
  • Authorization authorizes the user to use protected resources

•  9.2 Need for Application Security

  • Perimeter controls (firewalls, IDS) are not effective against application layer attacks
  • Ports 80 and 443 are typically open, allowing attackers to exploit application-level vulnerabilities

•  9.3 Application Security Administration

  • Protecting users from harmful applications
  • Preventing applications from creating or modifying executable files
  • Preventing applications from unnecessary resource access
  • Preventing applications from spawning into processes
  • Regularly updating and securely configuring applications

•  9.4 Application Security Frame

  • Includes input validation, authentication, authorization, configuration management, web servers
  • Includes application security frameworks, sensitive data protection, session management, cryptography
  • Includes securing the network (router, firewall, switch, IDS, IPS)
  • Includes securing the host

• 9.5 3W's in Application Security

  • Why: Applications are vulnerable to attacks due to global accessibility
  • Who: Managers, architects, developers, testers, and administrators are responsible for application security
  • What: Security is required at various stages during application development.

•  9.6 Secure Application Design and Architecture

  • Security negligence during design and architecture can lead to expensive problems
  • Security vigilance early on detects potential flaws
  • Secure design is based on earlier SDLC requirements but can be challenging

•  9.7 Goal of Secure Design Process

  • Identifying threats for developers, designing an architecture addressing threats, and enforcing secure design principles

•  9.8 Secure Design Actions

  • Design the application according to security specifications
  • Define secure coding standards for implementational aspects
  • Perform threat modeling to identify threats
  • Design secure application architecture

•  9.9 Security Requirement Specifications

  • Software security requirements are non-functional requirements ensuring confidentiality, integrity and availability
  • Stakeholders often overlook security requirements, leading to vulnerabilities
  • Security requirements should be part of the strategic application development processes

•  9.10 Define Secure Design Principles

  • Security through obscurity, secure the weakest link, use least privilege principle, secure by default, apply defense in depth
  • Do not trust user input, reduce attack surface, enable auditing, keep security simple, and enforce separation of duties

•  9.11 Threat Modeling

  • Identifying, analyzing, and mitigating application threats
  • Structured development process
  • Iterative and performed early during design phase, to expose threats

•  9.12 Threat Modeling Helps To:

  • Identify relevant threats
  • Identify key vulnerabilities
  • Improve security design

•  9.13 Threat Modeling Process

  • To identify security objectives, application overview, decompose the application, identify threats, identify vulnerabilities - Risk and Impact Analysis, Identify threats and vulnerabilities 

•  9.14 Design Secure Application Architecture

  • A typical web application has three tiers (web, application, database)
  • Security at each tier is critical; one vulnerability can affect the entire system
  • Design with a defense in-depth principle (multi-tier security)

•  9.15 Secure Coding Practices: Input Validation

  • Verify user inputs against various criteria
  • Critical to prevent injection attacks on web applications

•  9.16 Secure Coding Practices: Parameterized Queries and Stored Procedures

  • Parameterized queries distinguish between code and data
  • Prevents attackers from manipulating query intent

•  9.17 Secure Coding Practices: Unicode Normalization

  • Unicode normalization ensures strings are equivalent based on chosen form
  • Necessary for web apps to avoid vulnerabilities like XSS

•  9.18 Secure Coding Practices: Output Encoding

  • Converts unsafe characters into equivalent encoded values
  • Prevents XSS attacks.

•  9.19 Secure Coding Practices: Error/Exception Handling

  • Properly handle unusual errors to prevent impacting system integrity/confidentiality/availability

•  9.20 Secure Coding Practices: Secure Session Cookies

  • Cookies store session-specific data
  • Implement mechanisms to create random session IDs
  • Do not store plaintext passwords in cookies
  • Employ cookie timeout and randomization

•  9.21 Secure Coding Practices: Secure Response Headers

  • Security headers improve web application / application security
  • HTTP Strict Transport Security (HSTS): Force usage of HTTPS
  • Content Security Policy (CSP): Protect from XSS, code injection, clickjacking
  • Cache Control: Manage caching mechanisms

•  9.22 Secure Coding Practices: Obfuscation/Camouflage

  • Making code harder to understand by those aiming to breach or reverse engineer
  • Altering the structural aspects or encrypting strings

•  9.23 Secure Coding Practices: Code Signing

  • Digital signatures validate software integrity during installation/execution
  • PKI (Public Key Infrastructure) is used for this verification

•  9.24 Application Security Testing Tools

  • Provides listing of tools to perform automated security testing

•  9.25 Static Application Security Testing (SAST)

  • Involves detailed, systematic source code inspection
  • Performed toward end of code development, when stable

•  9.26 Types of SAST

  • Automated source code analysis, manual source code review

•  9.27 Dynamic Application Security Testing (DAST)

  • Involves simulating attacks on a running application from 'outside' perspective
  • Security professionals or tools like Netsparker, Acunetix, or HCL AppScan are used

•  9.28 Types of DAST

  • Automated and Manual application security scanning

•  9.29 SAST vs. DAST

•  SAST testing involves reviewing the programming code, while DAST testing involves testing the application's behavior by trying things from a user or other systems' perspective

•  9.30 Web Application Fuzz Testing/Fuzzing

  • Quality checking for vulnerabilities by input manipulation
  • Employs random data or fuzzing to perform testing

•  9.31 Steps of Fuzz Testing

•  9.32 Application Whitelisting

  • Allows only approved applications to run, denying all others
  • Protect application assets from threats
  • Improve system visibility/reduce attack surface by limiting what can run

•  9.33 Advantages of Application Whitelisting

  • Prevents Malware attacks
  • Mitigates zero-day attacks
  • Reduce attack surface and improve security
  • Improve computational efficiency

•  9.34 Application Blacklisting

  • Denies access to specified applications
  • Easy to implement
  • Low maintenance

•  9.35 Disadvantages of Application Blacklisting

  • Limited in scope, cannot cover new types of threats
  • Not up-to-date with new attacks

•  9.36 Using AppLocker for Application Whitelisting

  • Windows in-built tool for controlling applications/executables/scripts
  • Allows the control of files/folders/paths

•  9.37 Using ManageEngine Desktop Central for Application Blacklisting

  • Desktop Central is a third-party application to manage and restrict blacklisted applications
  • Users can block executables, settings, and more

•  9.38 Prerequisites and Disabling Local Group Policy

  • Steps to enable/disable local group policy

•  9.39 Setting Security Levels

  • Use to set, define and apply security policies or levels

•  9.40 Prohibit Software Features

  • Management of prohibiting applications
  • Adding, managing and updating software to a prohibited list for managing executable files

•  9.41 Additional Application Whitelisting and Blacklisting Tools

  • List of tools that help perform additional whitelisting/blacklisting tasks

•  9.42 Application Sandboxing

  • Isolates applications in a separate container to protect system from malicious activities
  • Ensures that applications can't access important files/resources

•  9.43 Application Sandboxing Tools

  • List of different sandbox tools

•  9.44 What is Patch Management?

  • Fix known vulnerabilities by installing appropriate patches
  • Steps involved in patch management (Detect, Assess, Acquire, Test, Deploy, Maintain)

•  9.45 What is Patch Management?

  • Choosing, verifying, testing, and applying/updating patches
  • Listing, recording, and deploying patches

•  9.46 Patch Management Tools

  • List of tools to support patch management tasks

•  9.47 Web Application Firewall (WAF)

  • Secures web server from malicious traffic
  • Places a filter/proxy in front of web application to analyze traffic

•  9.48 Benefits of Web Application Firewall (WAF)

  • Secures existing and productive web applications
  • Minimizes workload for developers
  • Provides cookie security with encryption
  • Prevents cross-site request forgery

•  9.49 Configuring URLScan to Setup as WAF For IIS Server

  • Using Microsoft URLScan tool
  • Configuring URLScan criteria

•  9.50 Web Application Firewalls (WAFS) Solutions

  • List of different WAF solutions available

•  9.51 Bug Bounty Programs

  • Challenge programs to find vulnerabilities
  • Rewards given for reporting security flaws

•  9.52 Web Application Security Scanners

  • Tools for identifying web application vulnerabilities

•  9.53 Proxy-Based Security Testing Tools

  • Tools for security testing of applications that uses proxy-based testing of web application security tests

•  9.54 Web Server Footprinting Tools

  • Tools for footprinting web servers to identify vulnerabilities

• 9.55 Module Summary

  • Module's core concepts
  • Software security and secure coding
  • Secure application development process
  • Tools to improve application security

General Note

• Various URLs are provided for specific tools and resources.

This quiz focuses on key concepts in security management and deployment diagrams. Participants will explore essential elements that administrators need to identify for effective application security and deployment. It covers scenarios, technologies, and external dependencies integral to the deployment process.